AIOS Governed Continuation
abe81d7f64
Ported from authority branch agent/g7-security-critical-closure-20260914 (d5f5c9b, base=beabd053).
S1 auth: role/user from server token->identity mapping, ignore client X-AIOS-* headers.
S2 bootstrap credential: PBKDF2 random-salt, fail-closed SECRET, no plaintext fallback, session HMAC+expiry.
S3 path containment + control-plane file-read hardening.
S4 admin UI XSS + real governed approval + dashboard CSRF/branch validation.
S5 runtime delivery: registry.yaml conflict, openapi securityScheme, install.sh fail propagation, do_POST shadowing.
Tests: 5 negative suites (66 tests). Evidence pack in deliverables/g7-evidence/.
53 lines
1.3 KiB
YAML
53 lines
1.3 KiB
YAML
# AIOS Agent Command Plane Registry
|
|
# Git is the single source of truth for all agent commands.
|
|
version: 1.0.0
|
|
registry_version: 1.0.0
|
|
created_at: 2026-07-08T15:44:00+08:00
|
|
baseline: V1R3C1
|
|
|
|
commands:
|
|
source: "git"
|
|
active_path: "agents/commands/active/"
|
|
running_path: "agents/commands/running/"
|
|
completed_path: "agents/commands/completed/"
|
|
failed_path: "agents/commands/failed/"
|
|
|
|
directories:
|
|
commands/active: "New commands pending execution — Git is the only entry point"
|
|
commands/running: "Commands currently being executed by an agent"
|
|
commands/completed: "Commands that finished successfully — moved here on success"
|
|
commands/failed: "Commands that finished with errors — moved here on failure"
|
|
|
|
policies:
|
|
path: "agents/policies/"
|
|
source: "git"
|
|
|
|
state:
|
|
path: "agents/state/"
|
|
source: "git"
|
|
|
|
agents:
|
|
- id: openclaw
|
|
type: executor
|
|
role: primary
|
|
- id: hermes
|
|
type: reviewer
|
|
role: supporting
|
|
- id: codex
|
|
type: reviewer
|
|
role: review
|
|
|
|
lifecycle:
|
|
new: active/
|
|
running: running/
|
|
success: completed/
|
|
failure: failed/
|
|
|
|
# Audit plane configuration
|
|
audit:
|
|
enabled: true
|
|
path: "audit/"
|
|
agent_runs: "audit/agent-runs/"
|
|
version_history: "audit/version-history/"
|
|
command_history: "audit/command-history/"
|